Health record rights in Delaware: what state law adds
In Delaware, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy faster or free in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
The seven answers
Do apps and wearables need your OK before sharing health data?Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in). Also signed, not yet in force: Delaware Personal Data Privacy Act as amended, duties of controllers (sensitive data consent) (January 1, 2027). Same answer in 26 of the 50 states, counting this one.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Comprehensive privacy law requires consent to process sensitive data, which includes health condition or diagnosis. An amendment effective Jan. 1, 2027 keeps consent, adds necessity, and lowers the threshold to 10,000 consumers.
Delaware Personal Data Privacy Act, duties of controllers (sensitive data consent). 6 Del. C. § 12D-106(a)(4) [Effective until Jan. 1, 2027]
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Not process sensitive data concerning a consumer without obtaining the consumer’s consent
Who it binds, in our words: (1) Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.
Delaware Personal Data Privacy Act, definition of sensitive data. 6 Del. C. § 12D-102(30) [Effective until Jan. 1, 2027]
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy)
Who it binds, in our words: (2) Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data.
Delaware Personal Data Privacy Act, session law and effective date. 84 Del. Laws, c. 197, § 3 (HB 154, approved Sept. 11, 2023)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
If this Act is enacted before or on January 1, 2024, this Act takes effect on January 1, 2025.
Who it binds, in our words: Persons that conduct business in Delaware or target products or services to Delaware residents and meet the 6 Del. C. § 12D-103(a) thresholds.
Delaware Personal Data Privacy Act as amended, duties of controllers (sensitive data consent). 6 Del. C. § 12D-106(a)(4)a. [Effective Jan. 1, 2027], as amended by 85 Del. Laws, c. 463
Signed, not yet in force · effective · read October 3, 2026 · source(delcode.delaware.gov)
The consumer consents to the processing of sensitive data.
Who it binds, in our words: (1) Controlled or processed the personal data of not less than 10,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a deadline shorter than 30 days, or a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Element (a) is met for long-term care facilities only: residents get copies on 2 working days' notice.
Deadline in the law: 45 days (not shorter than HIPAA's 30).
Fee rule: 24 Del. C. § 1761(d): copy "according to a payment schedule established by the Board of Medical Licensure and Discipline"; postage or shipping may be added.
Fee rule: 24 DE Admin. Code 1700-16.1: "$2.00 per page for pages 1-10", $1.00 per page for pages 11-20, $0.90 per page for pages 21-60, $0.50 per page for pages 61 and above.
Fee rule: 24 Del. C. § 1761(h): films, models, photographs or fetal monitoring strips at "the full cost of such reproduction".
Fee rule: 24 Del. C. § 1761(i): prepayment may be required, except for copies requested for a disability benefits program application. This waives prepayment, not the fee.
Fee rule: 24 Del. C. § 1761(c): on a change of physician, a summary may be forwarded at no charge if patient and new physician agree. This is optional and is a summary, not a copy.
Goes beyond the federal floor: yes.
Medical Practice Act, patient access to records, response deadline. 24 Del. C. § 1761(l)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
A person certified to practice medicine shall have 45 days from the closure of the record or the assembly of a complete record to fulfill a request for medical records unless a faster response is medically necessary.
Who it binds, in our words: Persons certified to practice medicine (physicians).
Medical Practice Act, patient right to a copy and fees. 24 Del. C. § 1761(d)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Patients, on their own behalf, shall have the right to obtain a copy of their medical records from any person certified to practice medicine according to a payment schedule established by the Board of Medical Licensure and Discipline.
Who it binds, in our words: Persons certified to practice medicine (physicians).
Medical Practice Act, prepayment exception for disability benefits applications. 24 Del. C. § 1761(i)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
This subsection shall not apply to copies of the records requested in order to make or complete an application for a disability benefits program.
Who it binds, in our words: Providers and their third-party release-of-information services.
Amending act for § 1761, effective date. 84 Del. Laws, c. 161, § 2 (approved Aug. 9, 2023)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
This Act takes effect 6 months after its enactment into law.
Who it binds, in our words: Persons certified to practice medicine.
Board of Medical Licensure and Discipline, patient records fee schedule for copies. 24 DE Admin. Code 1700-16.1
In force · effective · read October 3, 2026 · source(archive.regulations.delaware.gov)
$2.00 per page for pages 1-10
Who it binds, in our words: A patient requesting of a copy of his or her own medical records to be transferred to another physician or to be obtained on their own behalf
16 Del. C. § 1121(25)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Each resident has the right to purchase photocopies of such records or any portion of them, at a cost not to exceed the community standard, upon written request and 2 working days’ advance notice to the facility.
Who it binds, in our words: Residents of long-term care facilities
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
DHIN regulation lets patients opt out of CHR search by anyone but the ordering provider. DHIN publishes opt-out forms. Statute dates reflect SB 341, effective on signature Aug. 31, 2026. Sensitive-category consent rules not checked.
Set by a regulation.
Designated exchange: Delaware Health Information Network (DHIN).
DHIN regulation, Community Health Record definition (patient opt-out). 1 DE Admin. Code 104, § 2.0 (Delaware Health Care Claims Database Data Access Regulation)
In force · effective · read October 3, 2026 · source(regulations.delaware.gov)
Patients can opt out of allowing their CHR data to be searchable by anyone who was not the ordering provider
Who it binds, in our words: Patient records in DHIN's Community Health Record.
DHIN statute, designation as the State's HIE. 16 Del. C. § 10301(a)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
DHIN is the State’s sanctioned provider of health information exchange and health data utility services.
Who it binds, in our words: Delaware Health Information Network.
DHIN statute, privacy rule for patient-specific information. 16 Del. C. § 10307(a)(1)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
DHIN shall by rule or regulation ensure that patient specific health information is disclosed only with the patient’s consent or best interest to those having a need to know.
Who it binds, in our words: Delaware Health Information Network.
DHIN published opt-out forms. DHIN Governance and Transparency, Opt-Outs page
Use this form if you do not want your medical information to be accessible to authorized healthcare providers through DHIN.
Who it binds, in our words: Patients whose data flows through DHIN.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Added by 83 Del. Laws, c. 327 (HB 455), approved June 29, 2022, with no separate effective date clause. Exceptions cover malpractice plaintiffs, licensing boards and abuse investigations.
Production of reproductive health services records. 10 Del. C. § 3926A(b)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Notwithstanding any law or court rule to the contrary, in any civil action or proceeding, no health-care provider may disclose any of the following unless authorized in writing by the patient, the patient’s guardian, or legal representative:
Who it binds, in our words: Health-care providers, in civil actions or proceedings, for communications and examination information relating to reproductive health services.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Latest amendment listed is 83 Del. Laws, c. 364, approved July 25, 2022. Release is limited to listed cases, such as the patient or a court order.
Rights of patients in mental health hospitals or residential centers, clinical records. 16 Del. C. § 5161(b)(13)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
No information reported to the Department and no clinical records maintained with respect to patients shall be public records. Such information and records shall not be released to any person or agency outside of the Department except in conformity with existing law and as follows:
Who it binds, in our words: Mental health hospitals or residential centers.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Latest amendment listed is 83 Del. Laws, c. 364, approved July 25, 2022. Redisclosure is also limited by § 717(b).
HIV testing, confidentiality. 16 Del. C. § 717(a)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
No person may disclose or be compelled to disclose the identity of any person upon whom an HIV-related test is performed, or the results of such test in a manner which permits identification of the subject of the test, except to the following person:
Who it binds, in our words: Any person.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Latest amendment listed is 80 Del. Laws, c. 126, approved July 27, 2015. Disclosure is allowed with informed consent and in listed cases.
Conditions for disclosure to others of genetic information. 16 Del. C. § 1205(a)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
a person shall not disclose or be compelled, by subpoena or any other means, to disclose the identity of an individual upon whom a genetic test has been performed
Who it binds, in our words: Any person, for genetic information that can be identified as belonging to an individual or family (§ 1206).
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Private suits exist for narrow categories: HIV tests, genetic information, physician record access, and mental health facility patient rights. The privacy act is Department of Justice only. No general medical records right of action found.
Damages a court may award: HIV: $1,000 or actual damages if greater for negligent violations; $5,000 or actual damages if greater for intentional or reckless violations; plus attorneys' fees (16 Del. C. § 718). Genetic: actual damages (16 Del. C. § 1208(c)).
HIV testing subchapter, enforcement. 16 Del. C. § 718(a)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Any person aggrieved by a violation of this subchapter shall have a right of action in the Superior Court and may recover for each violation:
Who it binds, in our words: Violations of the HIV testing and confidentiality subchapter.
Genetic information, liability for unlawful disclosure. 16 Del. C. § 1208(c)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Any person who wilfully discloses an individual’s genetic information in violation of this subchapter, shall be liable to the individual for all actual damages, including damages for economic, bodily or emotional harm which is proximately caused by the disclosure.
Who it binds, in our words: Wilful disclosure of genetic information.
Medical Practice Act, patient records, civil action. 24 Del. C. § 1761(g)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
any aggrieved patient or the patient’s personal representative may bring a civil action for damages or injunctive relief, or both, against the violator.
Who it binds, in our words: Physicians who violate § 1761 (record transfer, retention and patient access).
Mental Health Patients' Bill of Rights, enforcement. 16 Del. C. § 5163
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
This subchapter shall be enforceable by the Attorney General or by any interested citizen.
Who it binds, in our words: Rights of patients in mental health hospitals or residential centers, in the Court of Chancery.
Delaware Personal Data Privacy Act, enforcement. 6 Del. C. § 12D-111(e) [Effective until Jan. 1, 2027]
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
shall be enforced solely by the Department of Justice
Who it binds, in our words: Controllers and processors under the Delaware Personal Data Privacy Act.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical and health insurance information are in the definition. Current text reflects 85 Del. Laws, c. 464 (HB 381), signed Sept. 2, 2026, effective on signature per the legislature's bill page.
Deadline to tell people: without unreasonable delay but not later than 60 days after determination of the breach of security.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Computer security breaches, definition of personal information (medical). 6 Del. C. § 12B-101(7)a.6.
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Medical history, medical treatment by a health-care professional, diagnosis of mental or physical condition by a health care professional, or deoxyribonucleic acid profile.
Who it binds, in our words: Any person who conducts business in this State and who owns or licenses computerized data that includes personal information
Computer security breaches, definition of personal information (health insurance). 6 Del. C. § 12B-101(7)a.7.
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
Health insurance policy number, subscriber identification number, or any other unique identifier used by a health insurer to identify the person
Who it binds, in our words: Any person who conducts business in this State and who owns or licenses computerized data that includes personal information
Notice to the Attorney General. 6 Del. C. § 12B-102(d)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
If the affected number of Delaware residents to be notified exceeds 500 residents, the person required to provide notice shall, not later than the time when notice is provided to the resident, also provide notice of the breach of security to the Attorney General.
Who it binds, in our words: Breaches affecting more than 500 Delaware residents.
Procedures deemed in compliance (HIPAA-regulated persons). 6 Del. C. § 12B-103(b)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
is deemed to be in compliance with § 12B-102(c) of this title if the person notifies affected Delaware residents in accordance with the maintained procedures when a breach of security occurs.
Who it binds, in our words: A person regulated by state or federal law, including HIPAA, that maintains breach procedures under its regulator's rules.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No disclosure, clinician review or human recourse rule found. HB 306 (chatbot disclosure) awaits Senate committee. SB 6 pre-authorization act has no AI terms. Insurance Bulletin 148 is guidance without these elements.
Related limit on AI (recorded, not counted in the answer): 24 Del. C. § 1720(k): "A nonhuman entity, including an agent powered by artificial intelligence, may not be certified to practice medicine in this State." Similar bars in §§ 1920 and 1773 (HB 191, signed Apr. 23, 2026).
Certification requirements to practice medicine, nonhuman entities. 24 Del. C. § 1720(k)
In force · effective · read October 3, 2026 · source(delcode.delaware.gov)
A nonhuman entity, including an agent powered by artificial intelligence, may not be certified to practice medicine in this State.
Who it binds, in our words: Certification to practice medicine. A prohibition only; it moves no level.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
8.3%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
90.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$79,325 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
5.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
13.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
